https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 17:46:57 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-96870 <p>The SureDash – Community, Courses &amp; Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;display_name&#39; parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is triggered when any user hovers over a comment&#39;s like counter on a community page, as the plugin&#39;s tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML, re-parsing the browser-decoded entity payload as live HTML.</p> <p>The SureDash – Community, Courses &amp; Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;display_name&#39; parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is triggered when any user hovers over a comment&#39;s like counter on a community page, as the plugin&#39;s tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML, re-parsing the browser-decoded entity payload as live HTML.</p> https://db.gcve.eu/vuln/fkie_cve-2026-96870 https://db.gcve.eu/vuln/ghsa-rcpx-g8xc-wvvp <p>The SureDash – Community, Courses &amp; Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;display_name&#39; parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is triggered when any user hovers over a comment&#39;s like counter on a community page, as the plugin&#39;s tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML, re-parsing the browser-decoded entity payload as live HTML.</p> <p>The SureDash – Community, Courses &amp; Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;display_name&#39; parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is triggered when any user hovers over a comment&#39;s like counter on a community page, as the plugin&#39;s tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML, re-parsing the browser-decoded entity payload as live HTML.</p> https://db.gcve.eu/vuln/ghsa-rcpx-g8xc-wvvp